Malicious code in cobrowsing-utils (npm)

Source: amazon-inspector a369ea5eb28ebfd7fddb1c5baa3fc22fb371761839c0a2bd7123df273acd2077 [email protected] executes a binary dropper as a side effect of requiring the package. index.js loads helpers.js which auto-runs main at import time. main assembles Cloudflare Workers hostnames from...

Malicious code in cobrowsing-decorators (npm)

Source: amazon-inspector bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588 On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from string-concatenation-obfuscated Cloudflare Workers endpoints...

Malicious code in cobrowsing-redis-module (npm)

Source: amazon-inspector 502c907b28a2866d4fc67be93a6417e535336938ce3e8c23f0f95e927c6711b6 index.js unconditionally requires./loader on import. loader.js selects a platform-specific endpoint, assembles C2 hostnames at runtime from split string arrays e.g...

Malicious code in cobrowsing-exception-filter (npm)

Source: amazon-inspector 715fc9a652bf5d69755ea21ef2a906c318c511fe433df0721a13e266c3646832 On require of cobrowsing-exception-filter, index.js unconditionally loads support.js, which selects a platform-specific endpoint from a hardcoded list of obfuscated hosts Cloudflare Workers subdomains such a...

Malicious code in cobrowsing-logger (npm)

Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling oob-worker.cf99-9b3.workers.dev, oob-worker.cf102-baf.workers.dev,...

Malicious code in cobrowsing-test-utils (npm)

Source: amazon-inspector d1bf15c3c22d00f3a54f331ad3195c9072a94320a03f0f519dfbe95ca2e834de [email protected] executes a full-host dropper on require. index.js loads support.js, which on import reconstructs obfuscated hostnames from string-fragment arrays Cloudflare Workers subdomains...

Malicious code in cobrowsing-k8s-module (npm)

Source: amazon-inspector 6cde47afeee95884dc83b3dab22855db86950fd58756900af5100d1286a7c7be On require of the package's main entry, bridge.js selects a platform-specific endpoint, reconstructs remote hostnames at runtime via array.join"" string-split obfuscation oob-worker.cf100-416.workers.dev,...

Malicious code in cobrowsing-configs (npm)

Source: amazon-inspector 45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558 On require of cobrowsing-configs, index.js loads polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...

Malicious code in cobrowsing-cobrowsing-core (npm)

Source: amazon-inspector c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9 [email protected] is a binary dropper disguised as a platform core package. On require/import index.js loads polyfill.js, the package selects a platform-specific payload for linuxx64,...

Malware in devplatform-spa-plugin-cobrowsing

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview devplatform-spa-plugin-cobrowsing is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in cobrowsing-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558 On require of cobrowsing-configs, index.js loads polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...

MAL-2026-12652 Malicious code in cobrowsing-configs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45bae002aa55664445a0af3da60cf5187e91f09e77eee63b2da3d4840b30d558 On require of cobrowsing-configs, index.js loads polyfill.js which downloads a platform-specific binary from hardcoded Cloudflare Workers endpoints...

MAL-2026-12653 Malicious code in cobrowsing-decorators (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588 On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from...

MAL-2026-12651 Malicious code in cobrowsing-cobrowsing-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c27e38e295cce55b33b75d72a22db6deb6a851e7739111a1979f8317961465b9 [email protected] is a binary dropper disguised as a platform core package. On require/import index.js loads polyfill.js, the package...

MAL-2026-12654 Malicious code in cobrowsing-exception-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715fc9a652bf5d69755ea21ef2a906c318c511fe433df0721a13e266c3646832 On require of cobrowsing-exception-filter, index.js unconditionally loads support.js, which selects a platform-specific endpoint from a hardcoded lis...

Malicious code in cobrowsing-k8s-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cde47afeee95884dc83b3dab22855db86950fd58756900af5100d1286a7c7be On require of the package's main entry, bridge.js selects a platform-specific endpoint, reconstructs remote hostnames at runtime via array.join""...

MAL-2026-12655 Malicious code in cobrowsing-k8s-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cde47afeee95884dc83b3dab22855db86950fd58756900af5100d1286a7c7be On require of the package's main entry, bridge.js selects a platform-specific endpoint, reconstructs remote hostnames at runtime via array.join""...

Malicious code in cobrowsing-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling...

MAL-2026-12656 Malicious code in cobrowsing-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d5fcbe415de738c1434d79c5b40d1afb7ea916b5ed4b7103b29e244e27169ea index.js unconditionally requires adapter.js on load. adapter.js reconstructs destination hostnames from string-split fragments assembling...